Log QRS reject status/error on account-facts sync_rejected

.github/workflows/invoke-cloud-run.yml

@@ -513,7 +513,7 @@ jobs:
 
             if [ "${attempt_seen}" = "true" ]; then
               if [ "${{ steps.service.outputs.path }}" = "/account-facts-sync" ]; then
-                filter="resource.type=\"cloud_run_revision\" AND resource.labels.service_name=\"${CLOUD_RUN_SERVICE}\" AND timestamp>=\"${started_at}\" AND (httpRequest.requestUrl:\"/account-facts-sync\" OR textPayload:\"account_facts\" OR textPayload:\"account_facts_sync\" OR textPayload:\"reason=\" OR textPayload:\"exc_type=\" OR textPayload:\"Firstrade\" OR textPayload:\"unauthorized\" OR jsonPayload.message:\"account_facts\")"
+                filter="resource.type=\"cloud_run_revision\" AND resource.labels.service_name=\"${CLOUD_RUN_SERVICE}\" AND timestamp>=\"${started_at}\" AND (httpRequest.requestUrl:\"/account-facts-sync\" OR textPayload:\"account_facts\" OR textPayload:\"account_facts_sync\" OR textPayload:\"qrs_reject\" OR textPayload:\"reason=\" OR textPayload:\"exc_type=\" OR textPayload:\"Firstrade\" OR textPayload:\"unauthorized\" OR jsonPayload.message:\"account_facts\")"
                 gcloud logging read "${filter}" --project="${GCP_PROJECT_ID}" --limit=40 --format=json > /tmp/afs-logs.json || true
                 python3 - <<'PY'
           import json

application/account_facts_publisher.py

@@ -294,7 +294,22 @@ def publish_firstrade_account_snapshot(
             )
         except Exception:
             raise AccountFactsPublishError("sync_unavailable") from None
-        if getattr(response, "status_code", None) != 200:
+        status_code = getattr(response, "status_code", None)
+        if status_code != 200:
+            qrs_error = ""
+            try:
+                body = response.json()
+            except Exception:
+                body = None
+            if isinstance(body, dict):
+                err = body.get("error")
+                if isinstance(err, str) and 0 < len(err) <= 96 and err.isascii() and err.replace("_", "").isalnum():
+                    qrs_error = err
+            # Safe diagnostics only: HTTP status + fixed QRS error token (no body dump).
+            print(
+                f"account_facts_sync qrs_reject status={status_code} error={qrs_error or '<none>'}",
+                flush=True,
+            )
             raise AccountFactsPublishError("sync_rejected")
         response_body = getattr(response, "content", None)
         if isinstance(response_body, (bytes, bytearray)) and len(response_body) > 8192: